A new botnet called Tengu, derived from the well-known Mirai botnet, has been identified targeting compromised Linux devices. Researchers from Nozomi Networks Labs found that Tengu can utilize a device's hardware watchdog feature to reboot itself whenever defenders attempt to terminate its main process. This persistence method allows Tengu to re-establish its operation even after being interrupted. The botnet primarily gains access through brute-force attacks on Telnet credentials. Tengu is capable of launching distributed denial-of-service (DDoS) attacks, which can overwhelm targeted systems and disrupt online services. This incident raises concerns for organizations relying on Linux devices, as Tengu's ability to persist poses a significant challenge for cybersecurity defenses.